42d232e167bc99f92f71033fae69c9e3540bf5f8e18305838fa675efc349f636

Sharing

Copy URL Twitter E-mail

General

Target

42d232e167bc99f92f71033fae69c9e3540bf5f8e18305838fa675efc349f636
Size

3.1MB
MD5

283b5868bd24f0cd6c439dc7446f570b
SHA1

c65520a6be3e14b3d35fb6b4cb880e96f5eaff5a
SHA256

42d232e167bc99f92f71033fae69c9e3540bf5f8e18305838fa675efc349f636
SHA512

d29986ddc2d1e4340c0278af52e01d4aaf99bc4bab389c76c1c3f3386389b7e7ba6a099100aef3d7f20ac75794bea23dc3278fdf7f84d6b46f76685cace766e2
SSDEEP

49152:W4SR+qNzHi2HQSXyJYC/ggggMlFvCuBafI6LFMDakWKP/huLCkLzLygIs2wQJJf+:eHHi2H7XyJOvKhLFMDwgh2PLu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42d232e167bc99f92f71033fae69c9e3540bf5f8e18305838fa675efc349f636

Files

42d232e167bc99f92f71033fae69c9e3540bf5f8e18305838fa675efc349f636
.exe windows:5 windows x86

aac9607b4fb4e976b5b017d88deb6b36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DecodePointer
InitializeCriticalSectionAndSpinCount
TerminateThread
GetExitCodeThread
CopyFileA
FreeResource
DeleteFileA
GetTempPathA
DeviceIoControl
GetSystemDirectoryA
GetModuleFileNameA
VirtualQuery
WaitForMultipleObjects
GetCommandLineW
GetCurrentProcessId
GetModuleHandleW
FormatMessageW
GlobalAlloc
GetVersionExW
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
LocalFree
LocalAlloc
CreateProcessW
LoadLibraryW
lstrcmpiW
GetDriveTypeW
CreateDirectoryA
GetModuleFileNameW
GetLogicalDriveStringsW
GetEnvironmentVariableW
GetCurrentThreadId
Sleep
GetSystemTime
ConvertThreadToFiber
ConvertFiberToThread
GlobalMemoryStatus
CreateFiber
DeleteFiber
SwitchToFiber
SetConsoleMode
ReadConsoleA
RaiseException
SetEvent
CreateEventW
ResetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTickCount
lstrlenW
GetNativeSystemInfo
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualFree
VirtualAlloc
IsBadReadPtr
VirtualProtect
SetLastError
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SizeofResource
LockResource
LoadResource
FindResourceW
WriteFile
CreateFileA
ReadFile
GetFileSize
CreateFileW
FindClose
FindNextFileW
MoveFileExW
MoveFileW
DeleteFileW
SetFileAttributesW
CreateDirectoryW
GetFileAttributesW
FindFirstFileW
GetCurrentProcess
WaitForSingleObject
SetEnvironmentVariableA
CloseHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFullPathNameW
SetConsoleCtrlHandler
FlushFileBuffers
WriteConsoleW
SetEndOfFile
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetFileAttributesExW
GetLastError
SetFilePointerEx
GetConsoleMode
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
GetACP
ExitProcess
MulDiv
SetFilePointer
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
VerSetConditionMask
VerifyVersionInfoW
GetLocalTime
lstrcpynW
InterlockedIncrement
InterlockedDecrement
lstrcpyW
GetModuleHandleA
IsDebuggerPresent
OutputDebugStringW
TryEnterCriticalSection
GetStringTypeW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
QueryPerformanceCounter
QueryPerformanceFrequency
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SleepEx
GetSystemDirectoryW
CompareFileTime
GetEnvironmentVariableA
GetFileType
GetStdHandle
PeekNamedPipe
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
WaitForSingleObjectEx
GetStartupInfoW
InitializeSListHead
SetCurrentDirectoryA
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
RtlUnwind
ExitThread
ResumeThread
GetModuleHandleExW
GetTimeZoneInformation
GetConsoleCP

user32

GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetWindowRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
IntersectRect
UnionRect
OffsetRect
IsRectEmpty
PtInRect
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
LoadImageW
MonitorFromWindow
GetMonitorInfoW
wsprintfW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
ShowWindow
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
LoadCursorW
SetCursor
InflateRect
SetWindowRgn
UpdateLayeredWindow
MoveWindow
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
CharNextW
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
IsWindowEnabled
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
PrivateExtractIconsW
DestroyIcon
DrawIconEx
GetProcessWindowStation
IsIconic
IsWindowVisible
SetWindowPos
DestroyWindow
IsWindow
CreateWindowExW
PostMessageW
SendMessageW
IsZoomed
DispatchMessageW
PostQuitMessage
KillTimer
SetTimer
MessageBoxW
DefWindowProcW
UpdateWindow
GetUserObjectInformationW
GetMessageW
TranslateMessage
SetFocus
HideCaret

advapi32

RegOpenKeyExW
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
GetTokenInformation
LookupAccountSidW
RegSetValueExW
GetUserNameW
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash

shell32

ShellExecuteA
DragQueryFileW
SHGetFileInfoW
SHGetFolderPathW

ole32

OleUninitialize
CoInitializeEx
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
CoCreateInstance

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

shlwapi

PathFindFileNameA
PathRemoveFileSpecA
PathIsDirectoryW
PathCombineW
PathRemoveExtensionA
PathFileExistsA
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
SHDeleteKeyW

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLine
ord1
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipAlloc
GdipFillPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdiplusShutdown
GdipFillRectangleI
GdiplusStartup
GdipSetStringFormatLineAlign

imm32

ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext

ws2_32

WSAIoctl
socket
accept
htonl
listen
WSACleanup
WSASetLastError
shutdown
ioctlsocket
gethostname
WSAStartup
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
recvfrom
sendto
getnameinfo
gethostbyname
closesocket
recv
send
WSAGetLastError
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

psapi

EnumProcesses
GetProcessImageFileNameW

urlmon

ObtainUserAgentString

gdi32

GetBitmapBits
SetBitmapBits
GetObjectA
SetTextColor
SetStretchBltMode
StretchBlt
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPointA
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreatePatternBrush
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
GdiFlush
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
TextOutW
CreateRectRgnIndirect
MoveToEx

crypt32

CertFindCertificateInStore
CertDuplicateCertificateContext
CertCloseStore
CertGetCertificateContextProperty
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertOpenStore
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertFreeCertificateContext

wldap32

ord145
ord219
ord46
ord14
ord216
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord41
ord117
ord26
ord27
ord208

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aac9607b4fb4e976b5b017d88deb6b36

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imm32

ws2_32

version

psapi

urlmon

gdi32

crypt32

wldap32

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 568KB - Virtual size: 568KB

.data Size: 47KB - Virtual size: 74KB

.rsrc Size: 194KB - Virtual size: 194KB

.reloc Size: 108KB - Virtual size: 108KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 568KB - Virtual size: 568KB

.data
Size: 47KB - Virtual size: 74KB

.rsrc
Size: 194KB - Virtual size: 194KB

.reloc
Size: 108KB - Virtual size: 108KB